Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    Proszę o sprawdzenie loga

    15.04.07, 01:07
    Przy ściąganiu wszedł mi wirus i paskudnie namieszał, wyłaczył mi Windowsa. Teraz chodzi ale bardzo wolno.



    Logfile of HijackThis v1.99.1
    Scan saved at 01:01:21, on 2007-04-15
    Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\nvraidservice.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\Program Files\Opera\Opera.exe
    C:\Documents and Settings\rob\Pulpit\hijackthis\hijackthis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.harem-world.pl/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
    O2 - BHO: (no name) - {A57EE9D7-0534-496A-B2B0-E95866D0C1B0} - (no file)
    O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
    O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [RecSche] C:\LifeView FlyVideo\RecSche.exe /Startup
    O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: Snip to my eSnips account - C:\Program Files\eSnips\res\SnipIt.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5AB34036-C3E1-4DB3-A94C-D7FC8333D682}: NameServer = 193.110.120.5,194.204.152.34
    O17 - HKLM\System\CCS\Services\Tcpip\..\{85F3A56A-8472-4863-85D5-A2103CD57D17}: NameServer = 193.110.120.5,194.204.152.34
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F5D78CF1-3845-42FB-985E-F52ED26B8C8A}: NameServer = 193.110.120.5,194.204.152.34
    O20 - AppInit_DLLs: C:\WINDOWS\system32\svch3.dll
    O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll
    O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Auto HotKey Poller - Unknown owner - C:\WINDOWS\system32\winpol.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program File
    Obserwuj wątek
      • robert911 Re: Proszę o sprawdzenie loga 15.04.07, 01:16
        "Wystąpił problem z aplikacją spoolsvv.exe i zostanie ona zamknięta."
        Przy włączaniu Windowsa pojawi mi się taki komunikat.
      • Gość: Kolobos Re: Proszę o sprawdzenie loga IP: *.escom.net.pl 15.04.07, 06:42
        > Przy ściąganiu wszedł mi wirus

        Oczywiscie sam... Instalujecie sobie pelno trojanow, a pozniej biadolenie.

        W hjt usun:
        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe, <- pliku userinit.exe nie ruszaj z dysku!
        O2 - BHO: (no name) - {A57EE9D7-0534-496A-B2B0-E95866D0C1B0} - (no file)
        O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe
        O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
        O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll <- sciagnij z google lspfix.exe i usun w nim ten plik, nastepnie usun plik z dysku. Nic inntego tam nie ruszaj.
        O20 - AppInit_DLLs: C:\WINDOWS\system32\svch3.dll
        O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll
        O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll

        Usluga do kasacji:
        O23 - Service: Auto HotKey Poller - Unknown owner - C:\WINDOWS\system32\winpol.exe

        Start->Uruchom->sc stop "Auto HotKey Poller"
        oraz: sc delete "Auto HotKey Polle"

        Wszystkie te pliki usun z dysku, w razie problemow killbox'em.

        Nie zmiescilo sie, doklej reszte od:
        O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program File

        Na koniec skan:
        www.pandasoftware.com/activescan/pol/activescan_principal.htm
        www.spywareinfo.com/xscan.php
        www.bitdefender.com/scan8/ie.html
        Po wszystkim nowy log.
        • robert911 Re: Proszę o sprawdzenie loga 15.04.07, 21:31
          Thx, komp śmiga:)

          > O10 - Unknown file in Winsock LSP: c:\windows\system32\yrbqrikzbwkfu.dll <-
          > sciagnij z google lspfix.exe i usun w nim ten plik, nastepnie usun plik z dysk
          Usunąłem, ale pojawiły się 2 nowe podobne robaczki, też usunalem lspfixem. Z dysku nie potrafię, bo to plik systemowy.



          Logfile of HijackThis v1.99.1
          Scan saved at 21:27:20, on 2007-04-15
          Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\WINDOWS\system32\nvraidservice.exe
          C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\Winamp\winampa.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
          C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
          C:\WINDOWS\system32\wdfmgr.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\WINDOWS\system32\wbem\wmiprvse.exe
          C:\WINDOWS\system32\wscntfy.exe
          C:\WINDOWS\system32\wbem\unsecapp.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\Documents and Settings\rob\Pulpit\hijackthis\hijackthis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bitdefender.com/scan8/ie.html
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
          F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
          O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
          O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [RecSche] C:\LifeView FlyVideo\RecSche.exe /Startup
          O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
          O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O8 - Extra context menu item: Snip to my eSnips account - C:\Program Files\eSnips\res\SnipIt.htm
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - download.bitdefender.com/resources/scan8/oscan8.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{5AB34036-C3E1-4DB3-A94C-D7FC8333D682}: NameServer = 193.110.120.5,194.204.152.34
          O17 - HKLM\System\CCS\Services\Tcpip\..\{85F3A56A-8472-4863-85D5-A2103CD57D17}: NameServer = 193.110.120.5,194.204.152.34
          O17 - HKLM\System\CCS\Services\Tcpip\..\{F5D78CF1-3845-42FB-985E-F52ED26B8C8A}: NameServer = 193.110.120.5,194.204.152.34
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
          O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

          • Gość: Kolobos Re: Proszę o sprawdzenie loga IP: *.escom.net.pl 15.04.07, 21:51
            > Z dysku nie potrafię, bo to plik systemowy.

            Dlatego napisalem zebys uzyl killbox'a!

            W hjt usun:
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bitdefender.com/scan8/ie.html
            F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
            O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe <- miales usunac ten plik, nie mowiac juz o wpisach.
            • robert911 Re: Proszę o sprawdzenie loga 15.04.07, 22:12
              > Dlatego napisalem zebys uzyl killbox'a!
              Próbowałem killboxem ale usuwa tylko na reboot, a przy okazji zaraz powstaje nowy robaczek. Jeśli traktuje go Lspfixem tylko to się nie mnoży. Podałem w logu jak wygląda nowy.

              > O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe <- miales usunac
              > ten plik, nie mowiac juz o wpisach.
              Jakie wpisy mam usunąć?




              Logfile of HijackThis v1.99.1
              Scan saved at 22:06:25, on 2007-04-15
              Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\csrss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\Explorer.EXE
              C:\WINDOWS\system32\spoolsv.exe
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              C:\WINDOWS\system32\nvraidservice.exe
              C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
              C:\Program Files\iTunes\iTunesHelper.exe
              C:\Program Files\Winamp\winampa.exe
              C:\Program Files\Messenger\msmsgs.exe
              C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
              C:\WINDOWS\system32\nvsvc32.exe
              C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
              C:\WINDOWS\system32\wdfmgr.exe
              C:\Program Files\iPod\bin\iPodService.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\WINDOWS\system32\wbem\wmiprvse.exe
              C:\WINDOWS\system32\wbem\unsecapp.exe
              C:\Program Files\Opera\Opera.exe
              C:\Documents and Settings\rob\Pulpit\hijackthis\hijackthis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
              F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
              O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
              O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
              O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [RecSche] C:\LifeView FlyVideo\RecSche.exe /Startup
              O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
              O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
              O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
              O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
              O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
              O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              O8 - Extra context menu item: Snip to my eSnips account - C:\Program Files\eSnips\res\SnipIt.htm
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O10 - Unknown file in Winsock LSP: c:\windows\system32\vdwgcxvxxjmfo.dll
              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - download.bitdefender.com/resources/scan8/oscan8.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{5AB34036-C3E1-4DB3-A94C-D7FC8333D682}: NameServer = 193.110.120.5,194.204.152.34
              O17 - HKLM\System\CCS\Services\Tcpip\..\{85F3A56A-8472-4863-85D5-A2103CD57D17}: NameServer = 193.110.120.5,194.204.152.34
              O17 - HKLM\System\CCS\Services\Tcpip\..\{F5D78CF1-3845-42FB-985E-F52ED26B8C8A}: NameServer = 193.110.120.5,194.204.152.34
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
              O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
              O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
              O23 - Service: NVIDIA Display Driver Service (NVSvc) -
              • Gość: Kolobos Re: Proszę o sprawdzenie loga IP: *.escom.net.pl 15.04.07, 22:14
                Wyslij mi na mail'a (kolobos (at) gazea.pl) log z comboscan.
                Wpisy masz usunac te co podalem.
                • robert911 Re: Proszę o sprawdzenie loga 15.04.07, 22:45
                  Kurde, nie było tych wpisów. Usunałem je Hijack. Spróbuję jeszcze raz.
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.